Advertisement
Preface
As I wrote in a previous blog post, I had an engagement last year where my task was to exfiltrate data from a workstation on some sort of storage media. The twist in that task was Lumension Sanctuary Device Control, and the version was 4.3.2, but I am not sure how newer version work and this seems to be a more general problem with device control solution, for example with Symantec products.
But what is a device control solution? In short, they audit I/O device use and block the attempts to use unauthorized devices. This includes hardware such as USB, PS/2, FireWire, CD/DVD so basically every I/O port of a computer. In my opinion, these are pretty good things and they offer a better looking solution than de-soldering the I/O ports from the motherboards or hot-gluing them, but on the other hand, they can be bypassed.
Bypass
OK, so what is the problem? Well the way these device control solutions work is that they load a few kernel drivers to monitor the physical ports of the machine. However... when you boot up the protected computer in safe mode, depending on the device control solution software, some of these drivers are not loaded (or if you are lucky, none of those modules will be loaded...) and this opens up the possibility to exfiltrate data.
In theory, if you have admin (SYSTEM maybe?) privileges, you might as well try to unload the kernel drivers. Just do not forget, that these device control solutions also have a watchdog process, that checks the driver and automatically loads it back if it is unloaded, so look for that process and stop or suspend it first.
In theory, if you have admin (SYSTEM maybe?) privileges, you might as well try to unload the kernel drivers. Just do not forget, that these device control solutions also have a watchdog process, that checks the driver and automatically loads it back if it is unloaded, so look for that process and stop or suspend it first.
In my case with the Lumension Sanctuary Device Control, I have found that when I boot the Workstation protected by the device control software in Safe Mode where, software's key logger protection module is not running... so I was still unable to use a USB stick, or a storage media, but I could plug in a keyboard for example...hmmm :)
As some of you probably already figured it out, now it is possible to use a pre-programmed USB HID, for example a Teensy! : ) I know about three different project, that uses this trick like these two mentioned in a Hackaday post, or this one. Unfortunately, the site ob-security.info no longer seems to be available (well, at least it is no longer related to infosec :D ), but you can still find the blog post and the files with the Wayback Machine.
For the hardware part, the wiring of the Teensy and the SD card adaptor is the same as I showed in the post on Making a USB flash drive HW Trojan or in the Binary deployment with VBScript, PowerShell or .Net csc.exe compiler post, so I will not copy it here again.
I have to note here that there are other ways to bypass these device control solutions, like the method what Dr. Phil Polstra did with the USB Impersonator, which is basically looks for an authorized device VID/PID and then impersonates that devices with the VID/PID.
Mitigation
Most probably, you will not need safe mode for the users, so you can just disable it... I mean, it is not that easy, but luckily there is a great blog post on how to do that. BTW, the first page of the post is for Windows XP, but you are not using XP anymore, aren't you? ;)
Alternatively, as I mentioned at the beginning, you might as well use some physical countermeasure (de-soldering/hot-gluing ports). That shit is ugly, but it kinda works.
Conclusion
Next time you will face a device control solution, try out these tricks, maybe they will work, and if they do, well, that's a lot of fun. :)
But don't get me wrong, these device control solutions and similar countermeasures are a good thing and you should use something like this! I know that they make doing business a bit harder as you are not able to plugin whatever USB stick you want, but if you buy a pile of hardware encrypted flash drives, and only allow those to be plugged in, you are doing it right ;)
- Hack Tool Apk No Root
- Hacking Tools Download
- Hacking Tools Usb
- What Are Hacking Tools
- Hacking Tools Windows
- Hack Tool Apk
- Pentest Box Tools Download
- Pentest Tools Url Fuzzer
- Pentest Tools Open Source
- Hacking Tools 2019
- Hacker Search Tools
- New Hack Tools
- Hack Tools
- Hackrf Tools
- Best Hacking Tools 2020
- Hacker Tools
- Hacking Tools Usb
- Hacker
- Tools For Hacker
- Hacking Tools For Beginners
- Hacking Tools 2020
- Pentest Tools For Windows
- Growth Hacker Tools
- Nsa Hacker Tools
- Hacking Tools Software
- Pentest Tools Github
- Hacker Tools Windows
- Hak5 Tools
- Pentest Tools
- How To Hack
- Pentest Automation Tools
- Github Hacking Tools
- Pentest Recon Tools
- Hacking Tools For Kali Linux
- Kik Hack Tools
- Hack Tools
- Android Hack Tools Github
- Hacker Tools For Mac
- Hacking Tools For Beginners
- Hacker
- Hacker Search Tools
- Computer Hacker
- Hack Tools Mac
- Hack And Tools
- Wifi Hacker Tools For Windows
- Hacking Tools
- Best Hacking Tools 2019
- Pentest Tools Download
- Hacker Tools 2019
- Physical Pentest Tools
- Hacking Tools And Software
- Hacking Tools 2020
- Pentest Tools For Ubuntu
- Hacker Tools For Mac
- How To Make Hacking Tools
- Hack Tool Apk No Root
- New Hacker Tools
- Tools 4 Hack
- Pentest Tools Nmap
- Pentest Tools Review
- Termux Hacking Tools 2019
- Hak5 Tools
- Pentest Tools Subdomain
- Hack Tools
- Hacker Tools For Ios
- Pentest Tools Windows
- Hacking Tools Usb
- Hacking Tools Software
- Pentest Tools Download
- Pentest Tools Android
- Hacker Tools For Mac
- Tools Used For Hacking
- Pentest Tools Github
- Hack Rom Tools
- Pentest Recon Tools
- Hackers Toolbox
- Pentest Tools Windows
- Hacker Tools Windows
- Pentest Tools For Android
- Hacking Tools
- How To Install Pentest Tools In Ubuntu
- What Are Hacking Tools
- Nsa Hacker Tools
- Best Pentesting Tools 2018
- Hak5 Tools
- Hacker Tools Free
- Hacking Tools
- Pentest Tools Find Subdomains
- Best Hacking Tools 2019
- Best Hacking Tools 2019
- Hacker Tools For Ios
- How To Install Pentest Tools In Ubuntu
- Hacker Tools For Mac
- Nsa Hack Tools
- Hacking Tools 2020
- Hackers Toolbox
- Hacking Tools Windows
- Termux Hacking Tools 2019
- Tools For Hacker
- World No 1 Hacker Software
- Hacking Tools For Windows
- Tools 4 Hack
- How To Make Hacking Tools
- Growth Hacker Tools
- Pentest Tools For Android
- Hack Tools
- Pentest Tools Framework
- Hacking Tools Usb
- Bluetooth Hacking Tools Kali
- Wifi Hacker Tools For Windows
- Hacker Tools For Pc
- Hacking Tools Pc
- Hacker Tools Windows
- Hacking Apps
- Pentest Tools Subdomain
- Termux Hacking Tools 2019
- Pentest Tools List
- Pentest Box Tools Download
- Hacking Tools And Software
- Hacking Tools For Pc
- Hacking Tools Download
- Hacking Tools
- Hacker Security Tools
- Hacker Search Tools
- Hacking Tools Hardware
- Hacker Tools Free
- Hacker Tools Github
- Install Pentest Tools Ubuntu
- Pentest Tools Bluekeep
- Pentest Tools Online
- Hack Tools For Games
- Hacking Tools 2019
- Hacking Apps
- Pentest Box Tools Download
- Easy Hack Tools
- Free Pentest Tools For Windows
- Hacker Tools Linux
- Tools Used For Hacking
- Pentest Tools Find Subdomains
- Pentest Tools Framework
- Hacker
- Black Hat Hacker Tools
- Tools For Hacker
- Hacker Tools Hardware
- Hacker Hardware Tools
- Tools For Hacker
- Pentest Tools Android
- Hack Tool Apk No Root
- Hacking Tools And Software
- Hack Tools Pc
- New Hack Tools
- Blackhat Hacker Tools
- Hacking Tools And Software
- Hack Tools 2019
- How To Make Hacking Tools
- Hack Tools For Windows
- Top Pentest Tools
- Hacking Tools Usb
- Pentest Tools Website Vulnerability
- New Hacker Tools
- Hacking Tools Usb
- Pentest Tools Find Subdomains
- Hacker Tool Kit